An employee receives a phone call from someone claiming to be from the company's IT department, stating that the employee's email account has been compromised and they need to verify their password immediately. The caller ID shows the company's main number. Which type of attack is this, and what should the employee do?

Whaling; ask for the caller's name and extension

Vishing; hang up and call the IT department using a known number

Pretexting; ignore the call because IT never calls

Spear phishing; provide the password to prevent account loss

A finance employee receives an email that appears to be from the CFO, urgently requesting a wire transfer to a new vendor. The sender domain is slightly misspelled (e.g., @company.co instead of @company.com), and the email contains a link to a login page. The employee is about to comply. What should the employee do FIRST?

Reply to the email asking the sender to confirm the request.

Click the link to see if the login page looks legitimate before entering credentials.

Forward the email to the IT helpdesk and wait for their response before doing anything.

Verify the request through a known, separate communication channel, such as calling the CFO directly.

A company is considering a new malware prevention strategy. They have a limited budget and need to protect against both known and unknown malware. Which approach is the most balanced?

Deploy antivirus with heuristic analysis and implement application whitelisting

Require users to run a full scan every week

Use only signature-based antivirus

Disable all USB ports and external devices

A financial institution is experiencing a rise in spear phishing attacks targeting its executives. The attackers are using personal details obtained from social media to craft convincing emails. Which combination of controls would most effectively reduce the success of these attacks?

Disable external email for all executive accounts.

Use a web filter to block social media sites for executives.

Implement DMARC email authentication, provide executives with social media privacy training, and enforce MFA on all executive accounts.

Increase the frequency of executive password changes and require longer passwords.

EC-CouncilSOC Essentials

Domain 2Objective 5

Malware, Phishing, and Social Engineering SCE Practice Questions (Page 9)

Part of the Fundamentals of Cyber Threats domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

9concepts

Questions 41–45

41application · medium
An employee receives a phone call from someone claiming to be from the company's IT department, stating that the employee's email account has been compromised and they need to verify their password immediately. The caller ID shows the company's main number. Which type of attack is this, and what should the employee do?
Select an answer first
42application · medium
A finance employee receives an email that appears to be from the CFO, urgently requesting a wire transfer to a new vendor. The sender domain is slightly misspelled (e.g., @company.co instead of @company.com), and the email contains a link to a login page. The employee is about to comply. What should the employee do FIRST?
Select an answer first
43expert · hard
A company is considering a new malware prevention strategy. They have a limited budget and need to protect against both known and unknown malware. Which approach is the most balanced?
Select an answer first
44expert · hard
A financial institution is experiencing a rise in spear phishing attacks targeting its executives. The attackers are using personal details obtained from social media to craft convincing emails. Which combination of controls would most effectively reduce the success of these attacks?
Select an answer first
45foundation · easy
Which of the following is a basic technique for preventing malware infections by detecting known malware signatures?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.

Malware, Phishing, and Social Engineering SCE Practice Questions (Page 9)

Questions 41–45

A company is considering a new malware prevention strategy. They have a limited budget and need to protect against both known and unknown malware. Which approach is the most balanced?

A financial institution is experiencing a rise in spear phishing attacks targeting its executives. The attackers are using personal details obtained from social media to craft convincing emails. Which combination of controls would most effectively reduce the success of these attacks?

Which of the following is a basic technique for preventing malware infections by detecting known malware signatures?

Keep studying — Fundamentals of Cyber Threats